PT-2002-1809 · Pgp+1 · Pgp+1

Published 2002-08-12 · Updated 2024-02-08 · CVE-2002-0788

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: PGP version 7.0.3

Description: The issue arises from an interaction between PGP and the Windows Encrypted File System (EFS) when the "wipe deleted files" option is used. This interaction creates cleartext temporary files that cannot be wiped or deleted due to strong permissions. As a result, certain local users or attackers with physical access could obtain cleartext information.

Recommendations: For PGP version 7.0.3, consider disabling the "wipe deleted files" option when used on Windows EFS to prevent the creation of unwipeable cleartext temporary files. Restrict access to sensitive data and ensure physical security of devices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2002-0788

Affected Products

Pgp

Windows Refs

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2002-0788 · Security Note
• http://securityfocus.com/bid/4702 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-05/0052.html · Vendor Advisory
• http://iss.net/security_center/static/9044.php · Vendor Advisory
• https://t.me/cvenotify/70652 · Telegram Post
• http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1/hotfix/ReadMe.txt · Note
• http://osvdb.org/4363 · Note